6a8baca09d57e422a76af7f6ccb8d97b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6a8baca09d57e422a76af7f6ccb8d97b_JaffaCakes118
Size

1.4MB
MD5

6a8baca09d57e422a76af7f6ccb8d97b
SHA1

faf8d68c4560766f392470e1c0506c6ac9bb197f
SHA256

5e9349755f9bfab2b998dcddc028385e50ccb5403ad48b9af72b38adc2db348a
SHA512

49f0d17c91c6d0eff617ed1d0ecbdab5c4dc5d9ffc10a15c43333735f3a8c867f9ae6cd80adf5f7f7c9044e41b4ce4c9b925887b89194720ea78e2dc5bb2740c
SSDEEP

24576:BeSZ6LUlVYvRKDDSYFka6fCnHG3DkJs3aX+AAhoOkKTLVrXy:Y1L4Dga6KnHG3Dky2+AApy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a8baca09d57e422a76af7f6ccb8d97b_JaffaCakes118

Files

6a8baca09d57e422a76af7f6ccb8d97b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c29fe35faf6f47c9a3af9f17d66c37fa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

GetUserNameExW

kernel32

WriteConsoleW
GetProcAddress
VirtualAlloc
GetCurrentThreadId
GetLastError
InitializeCriticalSection
ReadFile
CloseHandle
MulDiv
GetSystemInfo
lstrcmpW
GetStartupInfoW
GetCommandLineW
GetACP
GetOEMCP
CompareStringW
GetLocaleInfoW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
GetStringTypeW
HeapReAlloc
HeapAlloc
OutputDebugStringW
RtlUnwind
LoadLibraryExW
IsProcessorFeaturePresent
IsDebuggerPresent
GetCPInfo
IsValidCodePage
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TlsFree
TlsSetValue
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue

shell32

DragAcceptFiles
ShellAboutW
SHFileOperationW
ShellExecuteExW
SHGetFileInfoW
SHGetDesktopFolder
SHBindToParent
SHPathPrepareForWriteW
DragFinish

shlwapi

PathAppendW
PathAddBackslashW
PathFileExistsW
StrCmpIW
StrToIntW
StrFormatByteSizeW
StrCmpNIW
StrCmpNW
StrChrIW
PathFindExtensionW
PathIsRelativeW
PathIsRootW
PathIsNetworkPathW
PathRemoveFileSpecW
UrlCanonicalizeW
PathCreateFromUrlW
AssocCreate
StrRetToBufW

psapi

GetProcessImageFileNameW
EnumDeviceDrivers
GetModuleBaseNameW

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1005KB - Virtual size: 1004KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 375KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c29fe35faf6f47c9a3af9f17d66c37fa

Headers

File Characteristics

Imports

secur32

kernel32

shell32

shlwapi

psapi

Sections

.text Size: 75KB - Virtual size: 74KB

.rdata Size: 1005KB - Virtual size: 1004KB

.data Size: 4KB - Virtual size: 7.0MB

.rsrc Size: 375KB - Virtual size: 375KB

.text
Size: 75KB - Virtual size: 74KB

.rdata
Size: 1005KB - Virtual size: 1004KB

.data
Size: 4KB - Virtual size: 7.0MB

.rsrc
Size: 375KB - Virtual size: 375KB